f9bdd2f729a9b754cb9a63e0e35feb31016e3f7d094c4b99782c430d804f7205

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
Size

567KB
MD5

a92f412369acf81f4c94d4f1c19e2970
SHA1

6b18dc3d2e6ff98153233af5d38c6f5293fa976c
SHA256

f9bdd2f729a9b754cb9a63e0e35feb31016e3f7d094c4b99782c430d804f7205
SHA512

5f488a6323cf98d6232f4c9a1261c00cb617060aeefa35b46b79c15d8026077ae6edcdb98d084702f1ec5d5773161703c47fe1ed86a528f21fe4587c5964f936
SSDEEP

12288:tnM4rY4ApZUFo2TP7Vt5v7xIE7LenCzfwstECI3f3oS:tbYJaTzXxxI/njstECI3

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\youtube.exe = "C:\\Users\\Admin\\AppData\\Roaming\\youtube.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe:*:Enabled:Windows Messanger"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
4872	Winlogon.exe
3152	Winlogon.exe
1752	Winlogon.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3152-22-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-40-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-28-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-25-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-45-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-49-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-52-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-54-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-56-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-59-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-63-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-68-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-75-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3152-77-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 3152	4872	Winlogon.exe	92
PID 4872 set thread context of 1752	4872	Winlogon.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
388	reg.exe
4784	reg.exe
1884	reg.exe
3000	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	3152	Winlogon.exe
Token: SeCreateTokenPrivilege	3152	Winlogon.exe
Token: SeAssignPrimaryTokenPrivilege	3152	Winlogon.exe
Token: SeLockMemoryPrivilege	3152	Winlogon.exe
Token: SeIncreaseQuotaPrivilege	3152	Winlogon.exe
Token: SeMachineAccountPrivilege	3152	Winlogon.exe
Token: SeTcbPrivilege	3152	Winlogon.exe
Token: SeSecurityPrivilege	3152	Winlogon.exe
Token: SeTakeOwnershipPrivilege	3152	Winlogon.exe
Token: SeLoadDriverPrivilege	3152	Winlogon.exe
Token: SeSystemProfilePrivilege	3152	Winlogon.exe
Token: SeSystemtimePrivilege	3152	Winlogon.exe
Token: SeProfSingleProcessPrivilege	3152	Winlogon.exe
Token: SeIncBasePriorityPrivilege	3152	Winlogon.exe
Token: SeCreatePagefilePrivilege	3152	Winlogon.exe
Token: SeCreatePermanentPrivilege	3152	Winlogon.exe
Token: SeBackupPrivilege	3152	Winlogon.exe
Token: SeRestorePrivilege	3152	Winlogon.exe
Token: SeShutdownPrivilege	3152	Winlogon.exe
Token: SeDebugPrivilege	3152	Winlogon.exe
Token: SeAuditPrivilege	3152	Winlogon.exe
Token: SeSystemEnvironmentPrivilege	3152	Winlogon.exe
Token: SeChangeNotifyPrivilege	3152	Winlogon.exe
Token: SeRemoteShutdownPrivilege	3152	Winlogon.exe
Token: SeUndockPrivilege	3152	Winlogon.exe
Token: SeSyncAgentPrivilege	3152	Winlogon.exe
Token: SeEnableDelegationPrivilege	3152	Winlogon.exe
Token: SeManageVolumePrivilege	3152	Winlogon.exe
Token: SeImpersonatePrivilege	3152	Winlogon.exe
Token: SeCreateGlobalPrivilege	3152	Winlogon.exe
Token: 31	3152	Winlogon.exe
Token: 32	3152	Winlogon.exe
Token: 33	3152	Winlogon.exe
Token: 34	3152	Winlogon.exe
Token: 35	3152	Winlogon.exe
Token: SeDebugPrivilege	1752	Winlogon.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4452	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
4872	Winlogon.exe
3152	Winlogon.exe
3152	Winlogon.exe
1752	Winlogon.exe
3152	Winlogon.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 928	4452	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	87
PID 4452 wrote to memory of 928	4452	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	87
PID 4452 wrote to memory of 928	4452	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	87
PID 928 wrote to memory of 2756	928	cmd.exe	90
PID 928 wrote to memory of 2756	928	cmd.exe	90
PID 928 wrote to memory of 2756	928	cmd.exe	90
PID 4452 wrote to memory of 4872	4452	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	91
PID 4452 wrote to memory of 4872	4452	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	91
PID 4452 wrote to memory of 4872	4452	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	91
PID 4872 wrote to memory of 3152	4872	Winlogon.exe	92
PID 4872 wrote to memory of 3152	4872	Winlogon.exe	92
PID 4872 wrote to memory of 3152	4872	Winlogon.exe	92
PID 4872 wrote to memory of 3152	4872	Winlogon.exe	92
PID 4872 wrote to memory of 3152	4872	Winlogon.exe	92
PID 4872 wrote to memory of 3152	4872	Winlogon.exe	92
PID 4872 wrote to memory of 3152	4872	Winlogon.exe	92
PID 4872 wrote to memory of 3152	4872	Winlogon.exe	92
PID 4872 wrote to memory of 1752	4872	Winlogon.exe	93
PID 4872 wrote to memory of 1752	4872	Winlogon.exe	93
PID 4872 wrote to memory of 1752	4872	Winlogon.exe	93
PID 4872 wrote to memory of 1752	4872	Winlogon.exe	93
PID 4872 wrote to memory of 1752	4872	Winlogon.exe	93
PID 4872 wrote to memory of 1752	4872	Winlogon.exe	93
PID 4872 wrote to memory of 1752	4872	Winlogon.exe	93
PID 3152 wrote to memory of 4836	3152	Winlogon.exe	94
PID 3152 wrote to memory of 4836	3152	Winlogon.exe	94
PID 3152 wrote to memory of 4836	3152	Winlogon.exe	94
PID 3152 wrote to memory of 4532	3152	Winlogon.exe	95
PID 3152 wrote to memory of 4532	3152	Winlogon.exe	95
PID 3152 wrote to memory of 4532	3152	Winlogon.exe	95
PID 3152 wrote to memory of 4484	3152	Winlogon.exe	96
PID 3152 wrote to memory of 4484	3152	Winlogon.exe	96
PID 3152 wrote to memory of 4484	3152	Winlogon.exe	96
PID 3152 wrote to memory of 2404	3152	Winlogon.exe	97
PID 3152 wrote to memory of 2404	3152	Winlogon.exe	97
PID 3152 wrote to memory of 2404	3152	Winlogon.exe	97
PID 4836 wrote to memory of 4784	4836	cmd.exe	103
PID 4836 wrote to memory of 4784	4836	cmd.exe	103
PID 4836 wrote to memory of 4784	4836	cmd.exe	103
PID 4484 wrote to memory of 1884	4484	cmd.exe	104
PID 4484 wrote to memory of 1884	4484	cmd.exe	104
PID 4484 wrote to memory of 1884	4484	cmd.exe	104
PID 4532 wrote to memory of 388	4532	cmd.exe	102
PID 4532 wrote to memory of 388	4532	cmd.exe	102
PID 4532 wrote to memory of 388	4532	cmd.exe	102
PID 2404 wrote to memory of 3000	2404	cmd.exe	105
PID 2404 wrote to memory of 3000	2404	cmd.exe	105
PID 2404 wrote to memory of 3000	2404	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AyKhZ.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2756
- C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe
  "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe
    "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4784
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4532
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:388
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1884
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\youtube.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\youtube.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\youtube.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\youtube.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3000
- - C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe
    "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AyKhZ.bat

Filesize
143B

MD5
91c7ca71e475f94738561f6057b1b7e7

SHA1
cabf52c017c40baf4394f94048995f0d55ba165a

SHA256
32f3560b7e69707070076b6a71774324a12c4869ce26cad4999edd345e7fa683

SHA512
6d4e833401deda56bb08ccbc60fd1bb554c7c452180847b50edaf43fc4625fde157a0a8e372ad0e8833776e2e607052d6a5d4ae604e01de27dc3d0329516f566

Download Submit
C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe

Filesize
567KB

MD5
a92f412369acf81f4c94d4f1c19e2970

SHA1
6b18dc3d2e6ff98153233af5d38c6f5293fa976c

SHA256
f9bdd2f729a9b754cb9a63e0e35feb31016e3f7d094c4b99782c430d804f7205

SHA512
5f488a6323cf98d6232f4c9a1261c00cb617060aeefa35b46b79c15d8026077ae6edcdb98d084702f1ec5d5773161703c47fe1ed86a528f21fe4587c5964f936

Download Submit
memory/1752-33-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1752-46-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1752-26-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1752-30-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1752-39-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1752-35-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3152-25-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-63-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-28-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-22-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-77-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-75-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-45-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-68-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-49-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-52-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-54-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-56-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-59-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3152-40-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4452-19-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/4452-0-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/4872-44-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads